Minutes of the meeting of the Audit and Compliance Committee of the Board of Directors of the Cook County 
Health and Hospitals System held Wednesday, October 9, 2013 at the hour of 8:00 A.M., at 1900 West Polk 
Street, in the Second Floor Conference Room, Chicago, Illinois. 

I. Attendance/Call to Order 


Chairman Munoz called the meeting to order. In the absence of a quorum at that time, he appointed Director 
Collens as a substitute Member of the Committee for quorum purposes; therefore, a quorum of members was 
present. 

Present: Chairman Luis Munoz, MD, MPH and Director Lewis M. Collens (substitute Committee 

Member) (2) 

Director Hon. Jerry Butler 

Present 

Telephonically: Gerald Bauman (non-Director Member) 

Absent: Directors Reverend Calvin S. Morris, PhD and Carmen Velasquez (2) 

Chairman Munoz stated that Gerald Bauman was unable to be physically present, but was able to participate 
in the meeting telephonically. 

Director Collens, seconded by Chairman Munoz, moved to allow Gerald Bauman 
to participate in this meeting telephonically. THE MOTION CARRIED 
UNANIMOUSLY. 


Additional attendees and/or presenters were: 

Cathy Bodnar - System Chief Compliance and 
Privacy Officer 

John Cookinham - System Chief Financial Officer 
Bala Hota, MD - System Chief Information Officer 
Natasha Lafayette-Jones - Director of Health 
Information Management 


Ram Raju, MD, MBA, FACS, FACHE - Chief 
Executive Officer 

Elizabeth Reidy - System General Counsel 
Deborah Santana - Secretary to the Board 
Thomas Schroeder - System Director of Internal Audit 
John Jay Shannon, MD - Chief of Clinical Integration 
Dianne Willard - CCHHS Compliance Officer 


II. Public Speakers 

Chairman Munoz asked the Secretary to call upon the registered speakers. 
The Secretary called upon the following registered speaker: 

1. George Blakemore Concerned Citizen 


III **Report from System Corporate Compliance and Privacy Officer (Attachment #1) 

Cathy Bodnar, System Corporate Compliance and Privacy Officer, presented her report containing updates 
on the following subjects: Fiscal Year-To-Date Activity; Privacy Issues; Update on 340B Drug Pricing 
Program; and Professional Coding Reviews and Quality Improvement Actions. The Committee reviewed 
and discussed the information. 
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III. ^^Report from System Corporate Compliance and Privacy Officer (continued) 

Chairman Munoz requested an update on information technology security. Dr. Bala Hota, System Chief 
Information Officer, noted that the former System Information Security Officer had spearheaded that effort, 
and had a pretty well-established road map that he developed last year, prior to his leaving the organization; 
staff is in the process of executing their tasks relating to the project. Additionally, Dr. Hota noted that the 
equipment relating to the project has been placed in the budget. 

Dianne Willard, CCHHS Compliance Officer, and Natasha Lafayette-Jones, Director of Health Information 
Management, provided additional information regarding the Professional Coding Reviews. Following the 
presentation of the information. Chairman Munoz suggested that further thought be given to the idea of 
presenting the internal coding data in a format similar to McKesson’s presentation of the external coding 
data. Ms. Lafayette-Jones stated that the information presented in the McKesson data is relating to their 
internal review; however, the information presented on the System’s internal coding was the product of an 
external review - similarities and differences between internal and external reviews are like an apples to 
oranges comparison. In response to Chairman Munoz’s question regarding whether the System does the data 
points for each coder internally, as well, Ms. Lafayette-Jones responded affirmatively. She stated that the 
administration started that program shortly after the last Committee meeting; they are fine-tuning the data 
and will bring it back for the Committee’s review at the next meeting. 


IV. Action Items 

A. Minutes of the Audit and Compliance Committee Meeting, July 10, 2013 

Director Collens, seconded by Chairman Munoz, moved to accept the minutes of the 
Audit and Compliance Committee Meeting of July 10, 2013. THE MOTION CARRIED 
UNANIMOUSLY. 


B. Any items listed under Sections IV and V 


V. Closed Session Items 

A. Report from System Director of Internal Audit 

B. ^^^Report from System Corporate Compliance Officer 

C. Discussion of Personnel Matters 

Director Collens, seconded by Chairman Munoz, moved to recess the regular session and 
convene into closed session, pursuant to the following exceptions to the Illinois Open 
Meetings Act: 5 ILCS 120/2(c)(l), regarding “the appointment, employment, 
compensation, discipline, performance, or dismissal of specific employees of the public 
body or legal counsel for the public body, including hearing testimony on a complaint 
lodged against an employee of the public body or against legal counsel for the public 
body to determine its validity,” and 5 ILCS I20/2(c)(29), regarding “meetings between 
internal or external auditors and governmental audit committees, finance committees, and 
their equivalents, when the discussion involves internal control weaknesses, identification 
of potential fraud risk areas, known or suspected frauds, and fraud interviews conducted 
in accordance with generally accepted auditing standards of the United States of 
America.” THE MOTION CARRIED UNANIMOUSLY. 

Chairman Munoz declared that the closed session was adjourned. The Committee 
reconvened into regular session. 
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VI. Adjourn 


As the agenda was exhausted, Chairman Munoz declared the meeting ADJOURNED. 


Respectfully submitted. 

Audit and Compliance Committee of the 

Board of Directors of the 

Cook County Health and Hospitals System 


xxxxxxxxxxxxxxxxxxxxxx 

Luis Munoz, MD, MPH, Chairman 


Attest: 


XXXXXXXXXXXXXXXXXXXXXX 
Deborah Santana, Secretary 
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Meeting Objectives 

■ lb file quarteriy statistics on reactive (xrnpliance issues; 

■ lb discuss HIPAA/Ratient Privacy, Confidentiality & Security issues 
in both the internal and external environment; 

■ lb provide an update on the current status of the 340B Drug Pricing 
Program, and 

■ lb report monitoring statistics for facility/technical coding and 
professional fee coding. 
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F-YTD 2013 Activity 

Albtal of 316 Reactive Corporate Compliance Issues for — 2^ — 3*^^ Quarter 2013 

The Allegations Fall into the Categories that Follovv 


False Qaims 



HIPAA 

51% 


Actual Counts 

Privacy (HIPAA) 160 Conflict of Interest 20 Human Resources 19 HC Fraud 
^gulatory/Policy 37 False Qaims 18 Accurate Boote 8 Theft 


7 Research 
4 Other 
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Privacy Issues 


HIPAA/Patient Privacy, Confidentiality & Security Issues 

51% or 160 issues 

Not all issues are privacy breaches 

■ Requests for guidance 

- Release of information 

- Data exchange 

- Business Associate Agreements 

There are privacy breaches 

■ Case-by-case analysis of each incident to determine if a breach 

■ F-YTD issues - 36 or 22.5% 

■ Individuals affected - 137 
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Recognize our “HIPAA Heroes” 


HIPAA Heroes: 

Ms. Borders and 
Ms. Mason 

A few weeks ago, a man 
approached Valeric 
Borders and Roberta 
Mason individually and 
requested patient infor¬ 
mation. llic individual 
claimed to work for Cook 



Picturrd are Wlerie Barden (I), 
Specialty Clinic H and Roberta 
Mason (r} Specialty Clinic G-H-l 


County in the Rnance Department. Ms. Borders and 
Ms. Mason knew not to release this information without 
the proper authorizations and they refused his request, 
even after he pressured them. We've since learned this 
person does not work at Cook County, rather he works 
for a home care provider. By rchising the request, our 
employees safeguarded our patients’ privacy and pre¬ 
vented healthcare fraud. 

We applaud Ms. Borders and Ms. Mason for placing the 
safety of our patients' information first We admire and 
thank them both on behalf of our patients. 
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Micro to Macro Corrective Measures 


Specialty education does occur for the individual affected and/or the 
department affected 


Department of 

Obstetrics/Gynecology 

Corporate Compliance 
& 

HIPAA 


Tt»e Ortlcfl of Coriwratf CwnplUnee 


Fantus Medical, Nursing, and 
Administrative Leadership 
Meeting 

Corporate Compliance 
& 

HIPAA 


deve loped bv 

TIte Ofn£.e of Corpotace Coinplldhce 


Department of Medicine 
Corporate Compliance 
& 

HIPAA 


ckvfi'lof^ecl bv 

The Office ®f Corporate Compliance^ 

^gii I ' 


De partment of Su rgery 
Corporate Compliance 

tSf 

HIPAA 


ckvelopfidbv 

The OillcT of Coiporjitr Co 


Department of Pathology 
Corporate Compliance 
& 

HIPAA 


developed by 
The Office of Corporate Compliance 
2013 


Annual education 

A2013 focus on HIPAA/FPatient FYivacy, Confidentiality & Security Fundamentals 


CCMH5 


HIPAA-The Fundamentals 

Protecting patient privacy is your 
responsibility. 


e//«i i/(fn «rr<-jT 



Objectives 


Upon completion of this course, you should: 

1. Understand there are laws that protect patient 
health information 

2. Recognize you have a responsibility to protect 
patient health information 

3. Know your obligations to report privacy violations 

4. Realize there are consequences for failure to 
protect patients health information 


■ Process reviews, including policy updates 
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Current Events 


toajsljmjgtottllast 


EVENING NEWS 

wiA SCOTT PELLEY 


BUSINESS 


^etltasliinitonlJost 

Bloomberg 


(Clticnsoi^iinbunc 

NEWS 


HHS wants photocopy machines 
examined as part of data security 

“Affinity Health Plan, a New York managed care 
company, recently settled for $1.2 million in fines 
regarding claims that the company forgot to clear 
a hard drive containing PHI that was attached to 
a copy machine being removed from their 
administrative offices.” 

September 17, 2013 | By Michael Stovsky | The 
Washington Post 


CHICAGO 


SUN-TIMES 


Modern Healthcare 


Personal data of 4M patients at risk after 
Advocate burglary 

“Personal information for more than 4 million patients 
of Advocate Medical Group may be at risk after four 
computers were stolen in a July 15 burglary of an 
administrative building in Park Ridge, Advocate said 
Friday. 

August 23, 2013 | By Peter Frost and Julie Wemau | 
Tribune 


1,300 patient files hacked at University of 
Chicago Physicians Group 

“Someone hacked into more than 1,300 files of University 
of Chicago Physicians Group patients, according to news 
releases from the university and one of its collections 
contractors.” 

BY ART GOLAB 

Sun-Times Staff Reporter September 13, 2013 


FierceHealthlT 
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July 10^^ Audit & Compliance Committee 

Report on CCHHS Information Security 

The following categories were presented 

Administrative Safeguards 

■ Administrative actions, policies, and procedures to manage the selection, 
development, implementation, and maintenance of security measures to 
protect electronic protected health information and to manage the conduct 
of the covered entity's workforce in relation to the protection of that 
information. 

Physical Safeguards 

■ Physical measures, policies, and procedures to protect a covered entity's 
electronic information systems and related buildings and equipment, from 
natural and environmental hazards, and unauthorized intrusion. 
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Technical Safeguards 

■ Technology and the policy and procedures that protect electronic 
protected health information (ePHI) and control access to the ePHI. 


Definitions from the Security Rule 45 CFR Part 160 and Part 164, Subparts A and C 



COOK COUNTY HEALTH 
& HOSPITALS SYSTEM 


C^HS 


Page 11 of 24 





Questions? 
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Update on 340B Drug Pricing Program 

Obtained approval for all 16-off site dinics to partidpate in the HRSAOPA340B Drug 
Pridng Program through John H. Stroger, Jr. Hospital of Cook County. 



Clinic Location 

340B ID Number 

1 

Austin Health Center of Cook County 

DSH140124R 

2 

Qcero Health Center of Cook County 

DSH140124Q 

3 

Englev\cod Health Center of Cook County 

DSH140124P 

4 

Cottage Grove Health Center of Cook County 

DSH140124N 

5 

Fantus Health Center of Cook County 

DSH140124M 

6 

Logan Square Health Center of Cook County 

DSH140124L 

7 

Near South Health Center of Cook County 

DSH140124K 

8 

Oak Forest Specialty Health Center of Cook County 

DSH140124A 

9 

l>. Jorge FVieto Health Center of Cook County 

DSH140124J 

10 

Robbins Health Center of Cook County 

DSH140124H 

11 

Vista Health Center of Conk County 

DSH140124G 

12 

VNtodlawn Health Center of Cook County 

DSH140124F 

13 

Wxxly \Af nston Health Center of Cook County 

DSH140124E 

14 

Morton East Adolescent Health Center of Cook County 
(School Based) 

DSH140124D 

15 

Children's Advocacy Center 

DSH140124C 

16 

CORE Center 

DSH140124B 
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Professional Coding Reviews 

Externally Performed by McKesson 

■ Retrospectiye reyiews are performed quarterly. 

■ All staff performing CCHHS coding are reyiewed. 

■ Thirty (30) patient records are selected. 

■ The records reyiewed reflect a range of seryices. 

■ Performance is scored utilizing the following table: 


Accuracy Le\/els 

Scoring 

CPT/Modifiers ICD-9-CM 

Remediation 

IVininnum Standard 

95% 

95% 


Green 

O 

95-100% 

95-100%, 

Feedback on errors 

Yellciw 

o 

90 - 94.99% 

90 - 94.99%o 

Feedback; if no improvement in 3 quarters - corrective action plan. 

Orange 

• 

85 - 89.99% 

85-89.99%, 

Corrective action plan with customized training to address 
weaknesses. Corrective actions become more focused with 
increasing levels of monitoring until irrprovement. 


• 

Below 85% 

Below 85% 

Monitoring all coding. Corrective action plan with customized training 
to address v\^aknesses. If no irrprovement, removed from production. 
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Data provided by McKesson 
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Professional Coding - E&M 


12 


15 


19 


29 


30 


31 


33 


35 


CPT/IVtodifiers 


100 . 0 % 


90.0% 


96.7%, 


86.7%, 


90.0%, 


90.0%, 


92.0%, 


93.3% 


87.5%, 


93.8%, 


93.1%, 


86.7%, 


93.3%, 


12 

Data provided by McKesson 


Quarter 1 
Jan-Mar 2013 


Apr - Jun 2013 


CPT/Modifiers 


Evaluation and Management Codes 


100 . 0 %, 


97.0% 


100 . 0 %, 


99.2% 


Feedback; ongoing monitoring 


92.0%, 


92.0%, 


93.0%, 


93.3% 


99.2% 


Coder removed from production 


96.1%, 


95 . 7 % 


91.7% 


100 . 0 %, 


89.2% 


99.2%, 


99.2%o 


NA 


NA 


NA 


NA 


NA 


NA 


NA 


NA 


NA 


Feedback; ongoing monitoring 


NA 


93.5%o 


86.7% 


100.0%o 


90.6%o 


86.0%o 


90.0%o 


100.0%o 


90.0%o 


Remediation; 100%o monitoring until 
compliant. 



Feedback; ongoing monitoring 


NA 


NA 


Remediation; 100%o monitoring until 
Iconpliant. 


NA 


Feedback; ongoing monitoring 


Removed from coding 


Removed from coding 


NA 


Removed from coding 


NA 


90.0%o 


86.7%o 


96.8%o 


90.0% 


99.2%o 


96.7%o 


99.0%o 


96.7%o 


93.3%o 


100.0%o 


100.0%o 


93.9% 


Feedback; ongoing monitoring 



NA 


NA 


NA 


86.7%o 


85.9%o 


88.3%o 


Remediation; 100%o monitoring until 
compliant. 


96.7%o 


^Feedback; ongoing monitoring. 
Terminated 08/14/2013 


80.2%o 


98.3%o 


86.7%o 


Feedback; ongoing monitoring. 
Terminated 08/13/2013 


Feedback; ( 




Feedback; ongoing monitori 
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Professional Coding - E&M + 
Specialty 



Quarter 1 

Jan-Mar 2013 

Quarter 

Apr-Jun 2013 

Coder 

CPT/Modifiers 

ICQ-9<a\/l 

Action 

CPT/Modifiers 

ICQ-9-CM 

Action 

Evaluaticxi and Management Codes 

57 



Removed from coding 




58 

96.7% 

95.8%) 

NA 




50 

86.7% 

100.0%) 

Feedback; ongoing monitoring 

93.3%) 

95.0%) 

NA 

60 



Remediation; 100%) monitoring 
until compliant. 




62 

86.3% 

96.9% 

Feedback; ongoing monitoring 


100.0% 1 

Feedback; ongoing monitoring 

63 

90.0%) 

95.0%) 

NA 

90.0%) 

100.0%) 

NA 

75 




91.70%) 

89.20%) 

Coder is on FIVLA 

77 





86.70%) 

Remediation; 100% monitoring 
until compliant. 

78 

93.9 

100 

N^A 

93.9 

99.2 

N/A 

Podiatry 

41 

94.3%, 

98.6%) 

NA 

94.7%) 

96.9%) 

NA 

Pathology 

71 

98.1%) 

100.0%) 

NA 

100.00%o 

96.00%) 

NA 

72 

97.7%) 

99.3%) 

NA 

90.70%) 

91.70%) 

NA 

73 

97.8%) 

97.5%) 

NA 

100.00%o 

100.00%) 

NA 

74 

100.0% 

99.2% 

NA 

96.40% 

100.00% 

NA 

Radiology 

65 

97.1%) 

100.0%) 

NA 

100.00%o 

90.00%) 

NA 

66 

94.4%) 

92.7%) 

NA 

97.37%) 

99.14%) 

NA 

67 

100.0%) 

96.7%o 

NA 

90.91%) 

96.67%) 

NA 
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Data provided by McKesson 
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Professional Coding - Specialty Only 



Quarter 1 

Jan-Mar 2013 

Quarter 

Apr - Jun 2013 

Coder 

CPT/Modifiers 

IC09-CM 

Action 

CPT/Modifiers 

ICQ-9-CM 

Action 

Emergerxy Departirmt 

26 

93.9% 

100.0%) 

NA 




27 

90.6% 

100.0%o 

NA 

94.1 

100 

NA 

28 

96.8% 

100.0%) 

NA 

97.5 

100 

NA 

55 

90.3% 

96.8%o 

NA 

100 

100 

NA 

56 

93.9% 

100.0%) 

NA 




General Surgery 

32 

100.0% 

98.6%) 

NA 

100.0%) 

95.0%) 

NA 

38 

100.0% 

100.0% 

NA 

95.0% 

97.5% 

NA 

40 

94.7% 

94.1%, 

NA 

98.5%) 

96.9%) 

NA 

44 

90.9% 

96.2%) 

NA 




61 

100.0% 

98.0%) 

NA 

93.0%) 

100.0%) 

NA 

76 





100.00%o 

Remediation; 100% monitoring 
until cxxrpliant. 

C^thalmological Surgery 

34 

93.2% 

99.4%o 

NA 

92.3%) 

100.0%) 

NA 

Othopaedic Surgery 

46 

100.0% 

100.0%) 

NA 

r 100.0%) 

97.0%) 

NA 

Rastic Surgery 

7 

98.1% 

100.0%) 

NA 




Urdogic Surgery 

9 

96.4% 

98.2%o 

NA 




64 

92.2% 

100.0%) 

NA 



Remediation; 100% monitoring 
until compliant. 

Anesthesia 

68 




94.60%) 

100.00%) 

NA 

69 

95.2% 

98.4% 

NA 

94.10% 

99.20% 

NA 

70 

94.6%) 

96.7%) 

NA 

100.00%) 

98.30%) 

NA 
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Data provided by McKesson 
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Process Improvement - McKesson 


Request for Additional Information 

■ Query process between coders and providers. 

■ An intranet based, electronic communication portal. 

■ Links to the electronic medical record to allow providers to 
update the record. 

■ Identifies areas for documentation improvement to allow for 
coding specificity. 
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Data provided by McKesson 
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CCHHS Coding Reviews 

Externally Performed Review of Records 

Date Parameters: January 1,2012 - December 31,2012 

Inpatient Records - Provident Hospitai 

■ 1,635 inpatient records reviewed - 100% retrospective review. 


Number oF Records 
with Changes 

Total Number 

oF Records Revie\A«ed 

Accuracy 

Percentage 

10 

1,635 

99.4% 
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Data provided by CCHHS Heaith information Management 
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CCHHS Coding Reviews 

Externally Performed Review of Records 

Date Parameters: January 1,2012 - December 31,2012 

Emergency Room Records (including Trauma) 

Provident and John H. Stroger, Jr. Hospitals 

Provident Hospital ED - 5% Retrospective Review 

■ A random sample of 720 records reviewed 

■ Coded by CCHHS coding staff 

John H. Stroger, Jr. Hospital ED - 5% Retrospective Review 

■ A random sample of 2,269 records coded by CCHHS coding staff 

■ A random sample of 2,130 records coded by CCHHS External Vendor 
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Data provided by CCHHS Heaith information Management 
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CCHHS Coding Results 


Coding Category 


Principal Dagnosis 
Secondary Dagnoses 


Stroger ED 
Internal Coders 
Accuracy 
Percentage 


Stroger ED 
External Ccxiers 
Accxiracy 
Percentage 


Provident ED 
Internal Ccxiers 
Accxiracy 
Percentage 


Evaluation & Management (E&M) 


Modifiers 


Procedures 
Nursing Documentation 



'' Nursing Documentation - Medication infusion start and stop times 
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Data provided by CCHHS Heaith information Management 
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CCHHS Quality Improvement Actions 

■ Educate coders to improve coding accuracy by sharing 
external audit results. 

- Emphasize official coding guidelines for the assignment of 
principal diagnosis, secondary diagnosis and procedures. 

- Instruct coders on the assignment of Current Procedural 
Terminology (CPT) modifiers. 

■ Develop query process between coders and providers. 

■ Initiate internal quality review process. 
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Data provided by CCHHS Health Information Management 
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Questions? 
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